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ABSTRACT 

Parte  of  a  missile  perform  physical  roles --they  propel,  guide,  etc. 
Additionally,  they  play  operational  rolec--their  Joint  operation  must 
accomplish  a  mission,  and  because  missile  hardware  is  imperfect,  i.e.,  has 
failure  characteristics,  it  necessitates  certain  ground  operations.  Readi¬ 
ness  testing,  one  of  these  ground  operations,  is  that  set  of  tests  performed 
regularly  for  the  purpose  of  detecting  failures  that  have  occurred  in  the 
missile  and  launch  equipment.  An  important  adjunct  to  criteria  for  physical 
characteristics  of  readiness -testing  equipment  are  statements  derived  from 
operational  analyses  that  specify  (a)  what  tests  are  best  done  by  each 
testing  method,  (b)  the  best  test  frequencies,  and  (c)  the  preferred  equip¬ 
ment  locations  for  each  test]  these  are  operational  design  criteria.  Dif¬ 
ferent  testing  methods — check  periodically,  monitor  continuously,  leave 
alone — and  equipment  locations — van,  silo,  missile — could  yield  different 
readiness  probabilities  for  each  missile  function.  These  probabilities 
depend  on  the  particular  missile's  characteristics  (test-point  availability, 
failure  rates,  modes  of  operation,  etc.)  and  test  equipment  characteristics 
(test  completeness,  accuracy,  failure  rates,  etc.).  In  addition,  misBile 
system  concepts  or  constraints  (fixed  period  for  inspections,  required  tests, 
limited  weight  on  missiles,  etc.)  must  be  accounted  for  in  the  determination 
of  the  best  readiness -testing  method  and  test  equipment  location  for  each 
function.  This  is  done  in  on  analysis  employing  Markov  Processes  to  des¬ 
cribe  the  system  operation  and  a  discrete  programming  formulation  for  the 
decision  process.  Only  the  essence  of  the  analysis  is  described.  It  is  an 
example  of  the  application  of  Operations  Research  to  problems  of  missile 
ground  system  design.  Introductory  coimrents  include  a  discussion  of  the 
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roles  of  Operations  Research  in  equipment  design,  and  a  discussion  of  the 
general  readiness -testing  desiga  problem. 
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OPERATIONAL  DESIGN  CRITERIA  FOR  MISSILE 
GROUND  SYSTEMS:  READINESS  TESTING 

Sidney  I .  Firstman 

Engineering  Division 
The  RAND  Corporation 


INTRODUCTION 

Criteria  for  the  design  of  a  missile’s  ground  system  are  of  several 
natures.  At  present,  typical  criteria  will  state  conditions  like,  "elec¬ 
tronic  equipment  must  be  capable  of  unattended  operation  for  a  period  of 
60  days,"  or  "electronic  and  hydraulic  equipments  will  be  designed  so  that 
they  may  be  maintained  using  a  remove  and  replace  concept."  In  conjunction 
with  these  criteria  for  the  physical  requirements  of  the  equipment,  state¬ 
ments  derived  from  objective  studies  are  needed  to  specify  what  the  equip¬ 
ment  is  to  do,  how  well  it  must  do  these  tasks,  how  often,  and  so  forth. 

These  are  operational  design  criteria;  they  are  rules  for  the  use  of  the 
equipment ,  and  goals  or  guides  for  the  design  of  the  equipment.  In  the 
paat,  in  contrast  to  the  analytical  work  done  to  define  the  roles  and  con¬ 
tent  of  the  missile,  little  objective  attention  has  been  given  to  such 
criteria.  Instead,  they  have  been  set  by  the  methods  of  "rule  of  thumb" 
and  "engineering  judgment."  This  need  not  be  the  case,  however,  for  the 
mathematical  methods  that  we  typically  associate  with  the  field  of  Opera¬ 
tions  Re search --the  same  methods  that  have  been  useful  for  determining 
operating  rules  for  systems — can  be  employed  to  determine  such  operational 

design  criteria. 

The  utility  of  an  OR  study  in  the  realm  of  design  is  limited,  certainly; 
a  design  cannot  be  completed  by  an  OR  analysis.  An  OR  study  can,  however. 
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examine  the  requirements  placed  on  the  system,  and  in  some  cases  can  deter¬ 
mine  equipment  design  goals  that  tend  to  optimize  the  integrated  system 

design  or  performance ,  and  that  can  serve  as  points  of  departure  for  physical 

* 

design  studies.  This  paper  presents  the  essence  of  such  an  analysis.  Hie 
paper  examines  the  readiness -testing  requirements  for  a  fixed-site  ballistic 
missile  and  describes  (a)  a  mathematical  model  for  estimating  the  dependence 
of  missile  readiness  on  relevant  physical  and  operational  design  factors, 
and  (b)  an  aid  to  the  determination  of  a  readiness-testing  program  (i.e., 
operational  design  criteria)  for  each  missile  function. 

Operations  Research  and  Equipment  Design 

Id  addition  to  their  usefulness  in  determining  design  goals  within 
which  detailed  design  decisions  can  be  made,  operational  analyses  have  made 
contributions  of  at  least  two  other  natures  to  equipment  design.  It  is 
sometimes  true  that  while  an  engineer  with  a  particular  design  forte  will 
apply  his  best  objective  and  quantitative  design  knowledge  and  efforts  to 
design  problems  in  his  field,  he  will  tend  to  use  subjective  arguments  when 
asked  to  specify  the  total  system  design.  Often  such  a  designer  will  either 
not  consciously  consider  the  problems  of  optimizing  other  than  within  each 
specific  design,  or  he  will  minimize,  in  his  mind,  the  feasibility  or  im¬ 
portance  of  the  over-all  design  optimization.  This  is  especially  true  if 
the  over-all  design  requires  design  disciplines  other  than  his  own.  For 
some  of  these  system  design  problems,  the  tools  of  OR  are  well  suited  to 
optimize  the  over-all  design,  and  this  leads  to  the  second  area  of  possible 
contribution  of  OR  to  equipment  or  system  design.  Some  design  problems  can 

5 

The  details  of  the  analysis  can  be  found  in  Ref.  1. 
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be  formulated  and  solved,  using  mathematical  techniques  that  are  relatively 
new,  and,  for  the  most  part,  unique  to  the  field  of  OR. 

The  technical  literature  contains  numerous  examples  of  systems  that 
are  not  optimally  designed  vhile  elements  of  the  system  are  so  designed; 
this  is  a  design -marriage  problem.  For  some  of  these  cases,  an  OR  study 
can  show  ways  to  optimise  the  system  design  by  calling  for  the  best  combi¬ 
nation  of  element  designs .  One  exaggerated  example  of  this  design-marriage 

(2) 

problem  is  discussed  in  a  paper  by  Bailey.  In  that  article  the  design  of 
an  aircraft  is  shown  as  envisioned  by  each  of  the  separate  design-groups -- 
engine,  armament,  production,  etc.  The  aircraft  as  seen  by  the  engine 
design  group  has  an  airframe  that  is  drawfed  by  the  engine ;  the  armament 
group  sees  the  aircraft  much  like  a  flying  battleship;  while  the  production 
groups'  ideal  design  is  am  aircraft  constructed  of  straight  boards,  nailed 
together.  The  article  uses  this  design  comedy  to  illustrate  the  role  of  OR 
in  design  integration  for  optimum  system  performance. 

It  follows  then  that  an  GR  analysis  will  often  be  concerned  with  opti¬ 
mizing  those  parameters  of  a  system  that  are  typically  determined  by 
subjective  reasoning.  For  a  successful  analysis  (as  done  in  other  areas 
of  OR  application),  these  parameters  will  be  quantified,  as  will  be  the 
concepts,  notions,  and  reasons  that  would  be  employed  for  the  subjective 
analysis.  Here,  then,  is  the  third  area  of  possible  contribution  of  OR  to 
equipment  or  system  design;  an  OR  analysis  can  quantify  and  make  explicit 
some  of  the  notions,  reasons,  concepts,  and  parameters  that  heretofore  have 
been  expressed  qualitatively  and  employed  subjectively.  A  brief  example  may 
help  make  this  notion  explicit. 

When  investigating  the  pre-launch  checkout  problem  reported  in  Ref.  3/ 
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the  "value"  of  a  check  was  derived.  This  "value"  pulled  together  into  a 
quantifiable  tern,  the  notions  of  (a)  the  chance  of  failures  existing  prior 
to  the  test,  (b)  the  capability  to  find  failures,  and  (c)  the  chance  of 
causing  failures  during  the  test.  Persons  concerned  with  designing  check¬ 
out  equipment  knew  that  there  were  some  relationships  among  these  factors 
that  were  important,  and  this  "value"  terra  made  one  such  relationship 
explicit . 

This  is  an  example  of  important  (from  a  system  operation  viewpoint) 
design  concepts  that  are  vaguely  defined  by  intuition,  common  sense,  and 
subjective  arguments,  but  that  can  be  defined  in  a  specific  and  quantitative 
fashion  as  the  result  of  an  OR  analysis.  Tula  quantification  is  important, 
and  useful  to  design,  in  its  own  rights,  in  much  the  same  manner  that  a 
good  vocabulary  is  useful  to  speech  and  thought.  Without  proper  words, 
thoughts  can  be  conceived  and  expressed  only  imperfectly;  without  explicit 
statements  of  design  issues,  the  optimization  cannot  be  complete.  When 
employed  in  proper  context,  then,  an  OR  analysis  can  3erve  as  an  aid  to 
design  intuition  and  thinking. 

Certainly  there  are  shortcomings  to  the  operational  design  analyses 
that  are  performed.  As  for  other  areas  of  application  of  OR,  operational 
design  is  hampered  with  a  shortage  of  good  data.  Reliability  estimates  or 
performance  productions  must  often  be  used,  and  these  are  often  unreliable . 
Emphasis  must  be  placed,  then,  on  developing  design  decision  methods  that 
are  insensitive  to  large  data  errors.  Planning  and  decision  methods  are 
needed  that  are  useful  in  the  face  of  poor  data,  and  that  would  give  useful 
design  rules  that  accommodate  uncertainty  in  such  factors  as  reliability  or 
performance . 


P-2112 

5 


READINESS  TESTING  DESIGN  PKOP.TJCM 

Parts  of  a  missile  (missile  functions)  perform  physical  roles --they 
propel  the  missile,  they  guide  the  missile,  etc.  In  addition,  these  func- 
•"tions  play  operational  roles --they  must  operate  as  a  unit  to  accomplish  a 
mission,  and  because  missile  hardware  is  imperfect,  i.e.,  it  demonstrates 
failure  characteristics,  it  necessitates  certain  ground  operations.  Readi¬ 
ness  testing  is  one  of  these  ground  operations  that  is  made  necessary  by 
missile  unreliability,  and  its  effectiveness  is  measured  in  missiles  ready, 
which  is  an  operational  term.  Within  the  limits  imposed  by  the  system  cost 
and  operational  concept,  a  missile  should  be  ready  to  launch  as  much  of  the 
time  as  is  possible . 

Readiness  testing  is  that  set  of  tests  perforated  prior  to  « i  ex*t t 
according  to  a  test  program,  for  the  (primary)  purpose  of  detecting  failures 
that  have  occurred  in  the  missile  and  launch  equipment,  so  that  these  fail¬ 
ures  can  be  corrected. 

Numerous  physical,  operational  and  cost  factors  enter  into  an  investi¬ 
gation  of  readiness  testing.  Failures  in  the  missile  can  be  detected  only 
by  testing,  but  failures  caused  by  testing  also  act  to  degrade  the  missile's 
readiness.  Consequently,  the  possibility  of  these  test-caused  failures  must 
be  accounted  for  in  the  development  of  a  readiness -testing  program. 

Among  the  other  factors  that  enter  into  the  development  of  a  readiness 
testing  program  are  the  potential  capabilities  of  the  test  equipment  to 
detect  and  isolate  faults,  and  the  expected  propensities  of  the  test  equip¬ 
ment  to  falsely  indicate  a  defective  condition.  Missile  failures  that  are 
undetected  will,  potentially,  degrade  the  effectiveness  of  the  force,  and 
good  parts  that  are  called  bad  by  the  test  equipment  result  in  unnecessary 
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down  time  and  expense  for  repair. 

Failures  in  the  missile  and  the  test  equipment  characteristics  are  the 
physical  factors  that  enter  into  the  development  of  a  readiness -testing 
program;  they  are  reflected  in  the  generation  of  test  and  repair  requirements . 
In  addition,  the  resulting  operating  times,  such  as  the  time  required  to  test 
a  missile  and  repair  malfunctioned  parts,  must  be  accounted  for.  It  is  pos¬ 
sible  that  the  system  maintenance  concept  includes  a  planned  delay  in  repair¬ 
ing  a  known  malfunction;  this  could  prove  economical  and  must  also  be  ac¬ 
counted  for.  The  reasons  for  these  requirements  to  account  for  test,  repair 
and  maintenance  times  are  simply  that  a  missile  must  be  ready  to  launch  in 
order  to  be  launched,  and  if  a  missile  is  undergoing  test,  maintenance,  or 
awaiting  maintenance,  it  is  certainly  not  launch  ready. 

Lastly,  there  are  costs  associated  with  missile  testing  and  repairs, 
and  when  a  system  concept  is  being  prepared,  these  costs  should  play  a 
major  role.  Dollars  spent  on  test  and  maintenance  could,  perhaps,  be  better 
spent  for  more  missiles. 

It  can  be  seen  then  that  much  more  than  Just  the  details  of  such  physi¬ 
cal  factors  as  the  test  signal  requirements,  and  measurement  techniques 
enter  into  the  determination  of  a  readiness-testing  concept  and  program  - 
Readiness  testing  plays  an  operational  role;  it  affects,  and  in  turn  is 
affected  by  other  operations.  Therefore,  these  operational  factors  should 
be  accounted  for  when  determining  such  concepts  and  programs .  An  operation¬ 
al  analysis  would  be  integrated  with  hardware  analyses,  as  estimates  based 
on  such  physically  oriented  studies  are  necessary  inputs  to  an  operational 
study.  Then  the  operational  study  would  define  design  goals  that  tend  to 
give  the  best  operational  capability,  and  these  goals  must  in  turn  be 
translated  into  physical  items . 
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System  Readiness -Testing,  Concept 

It  appears  that  a  complete  readiness -testing  concept  for  a  missile  is 
developed  in  two  steps.  First,  a  readiness -testing  policy  or  concept  must 
be  developed  for  the  missile  as  a  whole,  operating  within  the  missile 
system;  this  would  be  integrated  into  the  system  design  concept.  Following 
this  determination,  the  readiness-testing  method  for  each  black-box  or 
function  within  the  missile  and  launch  equipment  must  be  determined;  this 
would  be  a  more  detailed  analysis  done  within  the  framework  of  the  system 
concept.  The  criteria  by  which  preferred  methods  and  frequency  of  testing 
are  chosen  need  not  be  the  same  for  both  levels,  and  particular  attention 
must  be  paid  to  the  proper  choice  of  criteria. 

A  missile  system,  by  the  nature  of  its  design  and  anticipated  employ¬ 
ment,  will  tend  to  dictate  a  broad  concept  (or  at  least  limits)  for  its 
readiness  testing.  (For  example,  a  missile  that  is  to  have  an  in-silo  re¬ 
pair  capability  could  probably  be  checked  periodically  with  little  or  no 
additional  cost  for  checkout  equipment,  as  maintenance  testing  equipment 
could  also  serve  as  peacetime  confidence  testing  equipment.)  Within  the 
broad  context  dictated  by  the  missile  operational  and  physical  characteris¬ 
tics,  other  considerations  would  then  be  brought  to  bear  to  determine  the 
system  readiness-testing  concept;  system  cost  is  the  primary  consideration 
in  this  realm. 

When  determining  the  system  operational  and  design  concepts,  one  should 
be  highly  concerned  with  the  system  cost.  Each  element  of  the  system  design 
and  operation  should  be  evaluated  against  the  dollar  sign,  and  the  system 
readiness  testing  concept,  i.e.,  whether  it  be  continuous  monitor,  periodic 
check,  or  leave  alone,  should  be  chosen  with  the  dollar  sign  a  critical 


decision  factor. 
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The  rationale  for  this  cost  criticality  at  this  stage  of  design  is 
that,  ideally  at  least,  support  dollars  can  be  exchanged  for  missile  dollars 
vhen  making  a  system  proposal  or  evaluation.  Missile  systems  are  often  com¬ 
pared  on  a  cost-effectiveness  basis,  and  in  this  type  of  evaluation  one 
important  effectiveness  determinant  is  the  number  of  missiles  launched  for 
a  given  system  cost.  Missiles  launched  per  system  dollar  are  determined  by 
how  many  are  procured,  how  they  are  based,  and  how  they  are  supported.  At 
this  stage  it  is  relatively  straightforward  and  certainly  meaningful  to 
evaluate  alternative  support  concepts  on  how  they  contribute  to  the  over-all 
system  effectiveness  when  their  costs  are  traded-off  with  the  alternative 
uses  for  the  same  dollars . 

Once  the  system  support  concept  has  been  determined  along  with  the 
system  operations  and  basing  concepts,  the  cost  constraint  often  loses  its 
meaning;  a  cost  context  then  becomes  more  appropriate  .  For  the  following 
stages  of  design  it  is  more  important  to  match  the  physical  designs  of  the 
missiles,  facilities  and  ground  equipment,  and  to  develop  the  methods  for 
support  for  the  system,  within  the  system  concept,  to  complement  the  physi¬ 
cal  designs  of  the  missile  and  facilities . 

An  important  element  in  the  investigation  of  a  system  concept  is  that 
system  characteristics  must  be  employed.  For  example,  the  determination  of 
a  system  periodic  inspection  policy  must  be  based  on  a  complete  missile 
mean -time -to -failure,  and  any  failure  within  the  missile  must  be  considered 
in  the  same  manner.  Average  repair  times  and  average  repair  costs  are  ele¬ 
ments  of  an  investigation  on  the  system  level. 

Readiness  Testing  of  Functions 


On  the  blackbox  or  function  level,  attention  should  be  directed  more 
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closely  toward,  adapting  the  ground  system  and  the  flight  article  to  each 
other.  Within  the  system  concept,  physical  characteristics  of  the  missile 
and  its  required  operations  can  be  employed  to  mold  a  test  program  and 
ground  equipment  to  the  missile.  Within  the  same  examination,  the  possibi¬ 
lity  of  modifying  the  initial  design  of  the  missile  to  improve  the  over-all 
system  capability  should  not  be  overlooked.  The  total  missile -ground  system 
must  function  for  the  missile  to  be  effective  and  therefore  the  missile-  and 
ground-systems  designs  should  be  complementary . 

Much  good  work  has  been  done  on  the  problem  o 1  determining  preferred 
system  testing  concepts,  see  for  examples  Refs,  h,  5,  o.  The  balance  of 
this  paper  will  be  devoted  to  the  complementary  problem  of  developing  a  test 
program  for  each  function  within  a  previously  chosen  system  concept. 

A  missile  emplaced  in  a  silo  is  tested  in  several  ways,  using  equipment 
in  several  locations.  (See  Fig.  1.)  For  safety  and  physical  reasons  seme 
functions  on  the  missile  are  monitored  continuously;  two  examples  are  propel¬ 
lant  or  oxidizer  tank  pressure  and  gyro  fluid  temperature .  Other  functions 
are  essentially  left  alone  for  extended  periods  of  time;  storable  (and  solid) 
propellant  engines  are  a  case  in  point.  Some  functions,  and  indeed  the 
major  portion  for  most  missiles,  are  checked  periodically.  They  are  checked 
because  failures  do  occur  while  a  missile  is  in  a  static  mode,  and  these 
failures  should  be  detected  and  repaired  before  a  launch  attempt  is  to  be 
made . 

Once  the  entire  oystem -design -and  operation  concept  has  been  determined, 
the  test  equipment  must  be  designed  to  operate  within  the  concept  which  will 
set  certain  bounds  on  the  desi@s,  e.g.,  bhe  time  between  periodic  inspections 
and  replacements.  One  important  question  for  the  equipment  designer  is,  for 
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those  missile  functions  for  which  design  freedom  exists,  how  does  one  decide 
whether  to  check  it  periodically,  or  to  monitor  it  continuously  (if  this  is 
possible),  or,  perhaps,  to  leave  it  alone  until  a  launch  attempt  is  to  be 
made?  Answers  to  these  questions  determine  the  nature  of  the  test  equip¬ 
ment  to  be  employed  within  the  system  concept,  and  the  following  mathemati¬ 
cal  model  and  decision  methods  are  intended  to  aid  engineers  in  such  design 
decisions . 

MATHEMATICAL  DEVELOPMENT 

Briefly,  the  readiness -testing  equipment  design  problem  we  are  address¬ 
ing  is  as  follows  (see  Fig.  1).  Test  equipment  can  be  located  in  a  van,  in 
the  silo,  or  aboard  the  missile.  For  some  systems  a  helicopter  might  re¬ 
place  a  van.  The  test  equipment  in  all  three  places  could  be  used  to  check 
periodically,  while  the  silo  and  missile  equipment  could  also  be  used  to 
monitor  continuously.  Because  of  their  different  capabilities  to  detect 
xailures,  the  timeliness  of  their  detections,  and  their  varying  propensities 
toward  causing  failures,  each  testing  method  will  (in  general)  give  a  dif¬ 
ferent  readiness  for  each  missile  function.  This  readiness  is  measured  by 
the  probability  that  the  function  will  be  operative  at  a  randomly  chosen 
future  time,  e.g.,  the  time  when  the  missile  must  be  launched . 

In  order  for  a  missile  to  be  ready  to  go  at  any  instant,  each  function 
must  also  be  ready  to  go  at  that  time .  This  characteristic  for  the  missile 
and  launch  equipment  will  be  called  P(up)j  i.e.,  the  probability  that  the 
missile  is  ready-to-go  (is  up)  at  any  time  chosen  at  random.  The  missile 
?(up)  is  dependent  on  the  readiness  probability  of  each  missile  function. 

The  problem  to  oe  solved  then  is:  what  test  actions  should  be  taken 
to  maximize  the  missile  ?(up)  within  the  constraints  imposed  by  the  missile 
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design,  system  operation,  safety,  and  other  relevant  conditions.  Restated 
in  other  terms,  within  the  confines  of  the  system  concept,  how  does  one 
choose  among  the  choices  of  checking  periodically,  monitoring  continuously, 
or  leaving  alone,  and  among  the  possible  locations  for  the  test  equipment, 
for  each  function  of  a  missile  and  launch  equipment,  in  order  to  make  best 
use  of  physically  constrained  tests  and  obtain  the  greatest  P(up)  . 

The  first  step  in  the  analysis  is  to  describe  a  missile  function's 
life  pattern  in  terms  of  movements  through  states.  Then  the  function's 
readiness  probability  will  be  determined  in  terms  of  state -to -state  transi¬ 
tion  probabilities.  Each  of  these  transition  probabilities  must  be  expressed 
in  terms  that  describe  the  physical  and  operational  elements  of  the  system, 
and  that  can  be  measured  or  estimated  with  adequate  accuracy.  (The  results 
of  the  analysis  are  essentially  insensitive  to  uncertainty  in  some  parameters.) 
Following  that,  a  means  for  choosing  among  test  methods  for  each  function 
must  be  developed.  Actually,  two  means  for  choosing  test  methods  must  be 
developed;  first,  one  is  needed  for  cases  when  no  real  constraints  are 
operative  other  than  those  imposed  by  the  system  concept  and  safety  and  phy¬ 
sical  considerations;  then,  a  method  is  needed  for  dealing  with  other  con¬ 
straints,  such  as  space  and  weight  limitations  for  the  test  equipment.  Only 
the  first  problem  will  be  considered  in  this  paper;  the  second  problem  is 
discussed  in  Ref.  1.  For  convenience,  the  analysis  will  be  described  in  a 
partially  reverse  order. 

Problem  Statement 

A  missile  and  ground-operating  equipment  necessary  for  launch  are 
assumed  to  be  composed  of  U  statistically  independent  parts  or  functions. 

It  ia  furtber  assumed  that  the  state--good  or  no  good — of  each  of  these 
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functions  can  be  determined  in  terms  of  function  performance  necessary  to 
insure  proper  system  performance.  Because  it  forces  limits  for  a  decision 
of  good  or  bad  to  be  made  in  an  a  priori  sense,  this  assumption  neglects 
the  chance  that  while  a  function  parameter  may  have  drifted  beyond  an  a 
priori  set  limit,  other  system  changes  may  have  occurred  to  compensate  for 
this  drift.  This  undesirable  feature  can  be  alleviated  by  aggregating  mis¬ 
sile  parts  into  larger  test  units. 

It  follows  from  the  assumption  of  statistical  independence  that  P(up) 
for  the  entire  weapon,  noted  simply  by  P,  is  given  by 


P 


Tf  (p  ) 

i,J,k  vrijk' 


(1) 


where 


=  P  (function  i  is  operative,  i.e.,  in  ready  condition, 
if  tested  using  method  j  and  equipment  in  location  k), 
and 


|  1,  if  readiness -testing  method  j  and  equipment  In 
location  k  is  used  for  function  i 

Xijk  =' 

J  0,  otherwise 

To  separate  those  functions  that  are  constrained  by  safety  or  physical 
reasons  from  those  for  which  design  freedom  still  exists,  let  the  constrained 


This  assumption  of  statistical  independence  does  not  hold  strictly 
for  all  test  methods.  For  example,  using  the  continuous  monitor  method  a 
common  test  item  may  monitor  several  functions.  If  these  functions  are  not 
grouped,  then  the  k  estimate  for  each  will  reflect  the  test  equipment's 

failure  probability,  and  hence,  P  given  by  Eq.  1  will  be  a  conservative 
estimate.  When  this  independence  assumption  fails,  the  effects  on  P  could 
be  significant,  but  the  decision  process  to  be  described  will  be  largely 
unaffected ■  This  is  because  each  P^,.  is  compared  to  each  alternative  Pijk 

estimate  on  on  individual  basis  and  in  this  context  each  estimate  is,  in 
essence,  separate  of  the  other  estimates  (except,  of  course,  that  all  terms 
are  based  on  this  same  system  concept)  because  at  that  time,  Just  it  is 
being  examined  with  all  other  factors  being  held  constant. 
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test  be  indicated  by  i  .  Then 


P 


77 

i=i 


c  F  c 


J/* 


j,k 


(2) 


The  design  problem  can  now  be  stated  as: 

Within  the  constraints  imposed  by  safety  and  physical  reasons,  and 
within  the  system  readiness  testing  concept,  determine  that  set  of 
xijk  3  1  30  that  p  given  by  Eq.  (2)  is  maximum  and 

>.  *iJk  - 1.  for  each  i.  (3) 

1 1  ^ 


The  method  of  solving  this  problem  is  nothing  r.o:'c  than  a  search  for 
the  best  ?1Jk  for  each  unconstrained  function.  A  design  tableau  is  useful 
to  facilitate  this  search  and  to  afford  designers  the  opportunity  to  examine 
alternative  test  groupings.  First,  a  useful  design  tableau  will  be  pre¬ 
sented;  then,  the  method  of  estimating  the  P,  ,  terms  will  be  considered. 

ijk 

Design  Tableau 

The  readiness  probability  estimates  for  each  function -test  method - 
equipment  location  combination  could  be  presented  on  a  tableau  .  Then,  for 
each  of  the  functions  with  design  freedom,  the  test  method  that  affords  the 
largest  readiness  probability  for  each  function  could  be  identified  and 
selected.  Physical  considerations,  however,  could  cause  a  compromise  of 
this  selection  to  be  desirable.  For  example,  scsae  tests  can  be  done  with 
common  equipment  and  the  above  decision  process  does  not  account  of 

this  opportunity  for  economy.  If  one  test  that  were  best  done  in  a 
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continuous  monitor  manner  could  be  done  using  the  same  equipment  as  another 
test  best  done  in  a  periodic  manner,  then  it  could  prove  economically  or 
operationally  desirable  to  do  both  tests  periodically.  If  the  readiness 
were  organized  into  a  tableau  such  as  Fig.  2.,  then  the  effects  on  the  over¬ 
all  P (up )  of  such  compromises  or  combinations  could  be  readily  observed. 

In  this  tableau  the  functions  1,  2,  3,  . ..,  represent  single  functions 
or  groups  of  functions  that  are  always  best  tested  as  a  group .  The  functions 
m  and  n  show  the  possibility  for  different  groupings  depending  on  the  test 
method  and  test  equipment  location. 

To  use  such  a  tableau  to  aid  in  the  design  decision  process,  one  would 

1.  Indicate  by  circling  those  tests  that  must  be  done 
for  reasons  of  safety  or  physical  requirements. 

2.  Fill  in  the  balance  of  the  readiness  terms  for  each 
test  method  and  equipment  location  combination  with 
data  from  the  appropriate  graph  (Fig.  3»  P*  25,  is 
an  example ) . 

3 .  Select  the  largest  readiness  probability  for  each 
unconstrained  function  and  indicate  it  with  a  V. 

k .  Form  the  product  of  "those  P  ,  terms  (one  from  each 

l«jK» 

column)  that  are  marked  with  a  V  or  0;  this  is  the 
"best"  over-all  r(up). 

5.  To  examine  other  convenient  test  groupings,  determine 
what  tests  can  be  grouped  with  other  tests  and  enter 
these  in  the  row  Tests  to  Group. 

6.  Use  Grouping  Comparison  row  to  compare  the  products 
of  the  grouped  terns  with  the  products  of  the  "best" 
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p(up)  terras ,  and.  determine  the  worth  of  non -best  test 
patterns. 

The  P. ,,  terms  must  now  be  quantified  in  terms  describing  germane 

1  jK 

physical  and  operational  factors.  These  terms  should  be  readily  estimable 
to  be  of  use. 


Derivation  of  P 


ijk 


Terms 


Under  the  assumption  that  a  missile  function  is  either  good  or  not-good 
at  any  time,  the  portion  of  the  life  span  of  a  function  that  is  spent  in  the 
silo  can  be  divided  into  five  states: 

1,  Operative,  there  are  no  failures  (malfunctions)  in 
the  function. 


2.  Inoperative- -unknown j  a  disabling  failure  has  occurred 
in  the  function  so  that  it  is  inoperative  but  the 
failure  is  undiscovered. 

3.  Inoperative --awaiting  maintenance;  a  disabling  failure 
has  occurred  in  the  function,  it  has  been  discovered, 
and  the  missile  is  down  awaiting  maintenance . 

4.  Being  maintained;  the  inoperative  function  is  being 
repaired  or  replaced  while  the  missile  is  down. 

5.  Undergoing  Periodic  Inspection  or  Preventive  Maintenance; 
the  missile  is  down  while  the  function  (or  all  functions) 
are  being  inspected  or  replaced. 


Under  these  assumptions  and  definitions,  it  is  necessary  that  all  functions 
on  a  missile  be  in  state  1,  i.e.,  operative,  in  order  for  the  missile  to  be 
ready  to  go.  It  is  plausible  that  preventive  maintenance  could  be  performed 
after  a  missile  is  removed  from  the  silo  and  replaced  with  another.  In 
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this  case,  the  down  time  is  counted  against  the  maintenance  operation  and 
should  be  considered  when  developing  the  system  maintenance  concept,  but 
is  not  germane  to  this  analysis  of  readiness  testing. 

Looking  now  at  each  function  separately,  it  is  seen  that  its  life  is 
a  series  of  states  with  defined  paths  of  possible  transitions  from  state 
to  state .  XI  the  missile  Is  rejuvenated  by  preventive  maintenance  every 
several  years  (perhaps  this  period  is  determined  by  the  shelf  life  of 
storable  propellants  or  composition  seals)  then  it  appears  that  wear-out 
iailunes  can  be  safely  neglected  in  an  examination  of  readiness  testing, 
except  that  proper  attention  must  be  given  to  the  constraints  imposed  on 
the  allowable  types  of  tests  fox  some  functions.  For  example,  mechanical 
parts  with  definite  wear -out  characteristics  probably  should  not  be  conti¬ 
nuously  exercised.  For  the  readiness -test  concept,  the  concern  should  be 
centered  about  the  randomly  occurring  failures.  And,  for  this  analysis, 
one  should  also  take  account  of  the  failures  that  are  caused  by  the  readi¬ 
ness  testing }  the  different  methods  of  testing  impose  different  stresses  on 
the  missile  functions. 

One  further  assumption  is  needed  before  the  analysis  can  continue; 
that  of  exponentially  distributed  failures,  rhe  Justification  for  this 
assumption  and  the  conditions  under  which  it  is  reasonable  have  been  dis¬ 
cussed  in  numerous  reports  (Refs,  k,  7,  6,  and  9,  for  example)  and  will 
not  be  discussed  here.  This  appears  to  be  a  reasonably  good  assumption 
for  many  physical  functions,  other  than  electronic,  and  there  is  much  ex¬ 
perimental  evidence  to  Justify  its  (cautious)  use. 

* 

Wear-out  phenomena  should  be  considered  when  determining  the  preven¬ 
tive  maintenance  concept — especially  for  functions  that  are  operated 
continuously . 
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Because  of  the  preceding  assumptions  on  the  statistics  of  the  failure 
distribution,  it  is  seen  that  the  probability  of  a  function  failing  in  a 
given  period  is  dependent  only  on  the  length  of  the  period  and  the  opera¬ 
tional  stresses,  and  is  thereby  independent  of  the  number  of  periods  of 
previous  use  (up  to  the  time  when  preventive  maintenance  is  necessary).  All 
other  state -to-state  transitions  depend  only  on  the  existing  state  and  the 
state  to  which  the  movement  is  to  be  made.  Therefore,  the  progress  of  a 
particular  function  through  its  operational  lifetime  can  now  be  viewed  as 
a  Markov  Process  which  will  be  described. 


Check  Periodically 

The  process  of  checking  periodically  is  the  most  tractable  of  the  two 

active  readiness -testing  methods  and  will  be  treated  as  an  example;  the 

* 

monitor  continuously  and  leave-alone  methods  are  discussed  in  Ref.  1.  The 
length  of  time  between  periodic  inspections  that  gives  the  best  system  per¬ 
formance  is  assumed  to  be  given  by  the  system  concept;  this  time  between 
periodic  inspections  will  be  called  T.  Each  missile  function  that  uses  the 
check  periodic  r^thod  is  inspected  every  T  days,  and  because  of  the  nature 
of  the  system,  defects  that  have  occurred  in  the  function  can  be  detected 

only  at  the  time  of  the  periodic  inspection. 

It  will  prove  useful  to  break  the  T  days  down  into  n±  smaller  time 
periods  of  t±  hours  each  and  the  time  required  for  the  missile  periodic 
inspection  9  so  that  a  periodic  interval  appears  as 


*As  inolied  earlier,  the  intent  of  this  paper  is  to  expound  the  require- 
vsnte  for^ope  rational  desisn  criteria  and  the  araU-de^llity  of  Operations 
teeeL-eh  t?lround  system  deslsn.  Details  of  the  analysis  are  in  Ref.  1. 
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H - 1 - 1 - 1 - I 

T  t±  2ti  3ti  ....  niti  T 

To  further  simplify  the  analysis,  the  quantity  of  time  t±  is  defined 
to  he  the  average  length  of  time  required  to  repair  or  replace  the  ith 
function.  This  includes  all  time  required  to  travel  to  the  missile,  unbot- 
ton  the  silo,  remove  and  repair  or  replace,  etc. 

Projecting  the  function's  operations  into  the  future,  it  appears  as  a 
series  of  intervals  of  length  T,  that  is  finally  ended  at  the  time  of  launch. 

Launch 

1 

H - ! - • - —  •  •  •  - 

T  T  T  T 

The  movements  of  a  missile  function  through  this  pattern  must  of  necessity 
demonstrate  periodic  properties.  The  chance  of  a  transition  from  one  state 
to  another  will  depend  on  whether  the  potential  movement  occurs  during  a 
periodic  Inspection,  or  between  inspections.  It  will  he  convenient,  there¬ 
fore,  to  define  three  transition  matrices:  A  defined  over  t^,  B  defined 
over  O,  and  C  defined  over  T. 

For  the  states  numbered: 

1.  Operative 

2 .  I nope rat ive - -unknown 

3.  Inoperative --awaiting  maintenance 

4.  Being  maintained 

(NOTE:  The  state  of  being  inspected  is  handled  differently; 
a  transition  matrix  will  be  defined  for  it.) 

A  E  matrix  of  single-step  transition  probabilities  in  time  t^,  for  the 


P-2112 

21 


interval  between  periodic  inspections. 

A  =a  ij  a  matrix  of  terms 

^  rsj  rs 

where 


00 


a  HP  (transition  from  state  r  to  state  s  in  one  interval 
rs 

of  length  t^). 

Similarly,  for  the  periodic  inspection 

E  E  matrix  of  single-step  transition  probilities  in  time  O,  for  the 


periodic  inspection. 


where 


(5) 


b  HP  (transition  from  state  r  to  state  s  during  the 
rs 

periodic  inspection). 

The  process  to  be  described  moves  through  steps  of  length  des¬ 
cribed  by  A,  and  one  step  of  length  &  described  by  B,  for  each  large  step, 
or  period,  in  its  life.  A  matrix  is  needed  to  describe  transitions  over 

the  entire  period  T. 

C  H  matrix  of  single-step  transition  probabilities  in  time  T  »  +  ©. 

If 


c  HP  (transition  from  state  r  to  state  a  in  one  interval 
rs 

of  length  T), 

and  if  it  is  observed  that  each  term  crg  is  a  term  compounded  from  arg  and 

b  terms;  that  is  (changing  notation  slightly  for  the  sake  of  clarity),  if 
rs 

&rv  =  the  probability  of  moving  from  state  r  to  state  v  in  time  ti 

and  bys  *  Pvs(&)>  the  probability  of  moving  from  state  v  to  state  s  in  time 
then 


c  =  p  (n.  t  +  fc) 
rs  *rs'  i  i  ' 


/  p  (n, t  )  p  (O) 
rv  i  i'  *vs  ' 


Where 


and 

\ 


this  means  that 


la  given  by 


A  *|E,rv(nlti)j’' 

B  -  {pTS(®>j, 


1 

C  a  c  > 
1  rs 

v  i 


C  =  A  iB. 


(6) 

(7) 


(9) 


(10) 


(ID 


The  next  step  In  finding  the  long-run  probability  of  being  in  state  1 
is  to  define  the  m-step  absolute  probability  vector  xv  . 


x 


(m) 


,  (m)  (a)  (m)  (m)» 

>  *2  »  x3  >  *4  > 


(12) 


wners 


(m) 

Xj/  ;  P  (function  being  in  state  k  after  m  periodic 
intervals ) 


and 


x<a+1)  _  x(m)c 


(13) 


If  matrix  C  is  either  regular  or  ergodic  (Ref.  10),  this  vector  has 
the  property  that  if  the  process  is  allowed  to  continue  sufficiently  long 
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that  the  effects  of  the  initial,  distribution  of  states  have  been  dissipated, 
then  for  sane  large  m,  a  steady  state,  or  fixed,  probability  vector  is  given 

by 

x  =  xC  (14) 


That  is,  the  long-run  distribution  of  states  following  a  periodic  inspection 
should  be  unaffected  by  an  additional  period  and  periodic  inspection. 

Solving  for  the  vector  x  (for  this  problem,  this  involves  the  solution 
of  5  simultaneous  linear  equations;  one  for  each  x^  and  one  that  expresses 
the  sum  of  the  's  equals  unity)  gives  the  probability  of  the  function  being 
in  each  state  following  a  periodic  inspection  that  is  conveniently  long  re¬ 
moved  from  the  time  of  initial  installation.  In  particular,  this  could  be 
the  inspection  that  precedes  the  beginning  of  hostilities. 

Hostilities  can  begin  at  any  randomly  chosen  time  (with  respect  to  the 
readiness  testing  schedule)  and,  therefore,  a  measure  is  needed  for  the 
probability  of  each  function  being  operative  at  any  randomly  chosen  future 
time.  If  the  vector  describing  the  state  probabilities  in  the  time  follow¬ 
ing  a  (steady  state)  periodic  inspection  is  given  by  x,  as  before,  then  for 
r  time  periods  of  length  t  later 

*<r)  -  xAr  (15) 


where 


) 


Neglecting  for  d  <  t^  and  in  turn  t^  «  T,  and  therefore  only  a  small 
error  will  result,  the  probability  of  the  function  being  operative  at  time 
of  launch  is 
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r  1  i  /  \ 

E  Ix^1^  *  Pijk  “  X1  ,  for  each  «3  a*"1  k* 

The  reason  for  this  fora  of  the  expectation  of  over  the  n±  time 

interval  is  because  the  launch  attempt  could  occur  at  any  time  with  equal 

likelihood . 

The  necessary  matrices  must  now  be  developed  using  terms  describing 
the  missile  function's  physical  characteristics,  the  test  equipment’s  capa¬ 
bilities  and  error  propensities,  and  the  system  operation  and  maintenance 
concepts.  This  is  an  involved  and  somewhat  lengthy  process,  but  not  diffi¬ 
cult.  Because  it  is  not  essential  to  an  understanding  of  the  essence  of 
the  problem  and  solution,  it  will  not  be  presented  in  this  paper;  it  is 
contained  in  Ref.  1.  The  results  of  such  an  analysis  are  curves  showing 
the  dependence  of  PiJk  on  the  several  parameters;  Fig.  3  is  a  plot  for  one 
set  of  parameters  for  the  check -periodically  test  method.  Such  curves  for 
the  continuous  monitor  and  leave -alone  methods  can  be  obtained  by  similar 

analyses . 

It  is  seen  that  the  descriptions  on  Fig.  3  are  based  on  such  factors 
as  1)  the  function  reliability,  expressed  in  mean-time-to-failure  under 
ground  conditions;  2)  the  test  equipment  access  and  accuracy  which  give  the 
p  q  estimates  which  are,  respectively,  the  probability  of  the  tester 
calling  a  good  function  good,  and  the  probability  of  the  tester  calling  a 
bad  function  bad;  3)  the  test  period  T,  obtained  frc®  the  system  concept; 

4)  the  chance  of  not  causing  a  failure  by  testing  d;  and  5)  a  measure  of  the 
maintenance  concept  a,  i.e.,  an  accounting  for  planned  delays  in  rr  -airing 
a  xnown  failure.  For  these  particular  curves,  the  average  time  to  repair 
a  malfunctioned  part,  t,  was  included  in  the  analysis,  but  its  impact  on 
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the  results  was  found  to  be  insignificant.  In  essence,  these  curves  tell 
you  that  if  you  test  a  function  having  the  characteristics  of  reliability, 
and  d,  using  test  equipment  with  the  characteristics  of  p  and  q,  according 
to  a  concept  with  the  characteristics  of  a,  t,  and  T,  then  a  particular 
readiness  will  result. 

From  these  sorts  of  curves  we  can  get  the  readiness  probability  for 
each  function  on  the  missile  for  each  combination  of  method  and  equipment 
location.  To  use  these  numbers  we  have  laid  out  the  design  tableau  of 
Fig.  2.  If  complete  design  freedom  exists  beyond  the  constraints  imposed 
by  safety  and  physical  considerations,  then  this  process  will  yield  the 
theoretically  best  readiness -testing  program,  consistent  with  the  system 
concept.  This  program  can  then  serve  as  a  point  of  departure  for  physical 
design  studies  and  necessary  operational-design  compromises . 
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